authorizeRequests() order makes a difference?

Question

I am learning Spring and want to know why there is difference when I change order of these two authorizeRequests() methods:

This works fine:

security.authorizeRequests()
    .antMatchers("/css/**")
    .permitAll();

security.authorizeRequests()
    .anyRequest()
    .authenticated();

This does not:

security.authorizeRequests()
    .anyRequest()
    .authenticated();

security.authorizeRequests()
    .antMatchers("/css/**")
    .permitAll();

What I mean by "doesn't work" is that in my login page CSS is not applied while using second example. Why order of these two methods actually matters?

Answer 1

When multiple children to the http.authorizeRequests() method each matcher is considered in the order they were declared. In your second example it define every request require authentication.